diff --git a/addons/point_of_sale/controllers/main.py b/addons/point_of_sale/controllers/main.py
index 2bba0a1c693..3e7fd30c2b4 100644
--- a/addons/point_of_sale/controllers/main.py
+++ b/addons/point_of_sale/controllers/main.py
@@ -28,6 +28,9 @@ class PosController(PortalAccount):
         :type config_id: str.
         :returns: object -- The rendered pos session.
         """
+        is_internal_user = request.env.user.has_group('base.group_user')
+        if not is_internal_user:
+            return request.not_found()
         domain = [
                 ('state', 'in', ['opening_control', 'opened']),
                 ('user_id', '=', request.session.uid),